Privacy notice

1. Who is responsible for your data

Snowffusion Foods, a sole proprietorship operating the ColdRun platform at coldrun.in, decides why and how personal data is processed here. Under India's Digital Personal Data Protection Act, 2023, that makes us the Data Fiduciary and you the Data Principal.

Our registered address is being added to this notice and is available on request from the contact below.

2. What we collect, and why

We collect what a shipment cannot be arranged without, and stop there. The lists below are exhaustive for each kind of account.

• Everyone: name, email address and mobile number, taken at sign-up, used to identify you, sign you in, and contact you about your shipments.
• Businesses booking transport: company name, GSTIN, business category and city, plus the pickup and delivery addresses, contact names and mobile numbers on each requirement. Those reach the transport partner only once you accept their quote.
• Transport partners: company name, owner name, GSTIN, PAN, business address and — if you provide them — bank account details. Compliance documents you upload, and each vehicle's registration, insurance, fitness and PUC expiry dates. Documents are read by a person before approval.
• Drivers assigned to a trip: name, mobile number, licence number and licence expiry, entered by the transport partner who employs them.
• Shipments: status updates with timestamps, temperature readings where a sensor is fitted, and proof of delivery including the receiver's name and a delivery photograph.
• Payments: the amount, the gateway's payment and order identifiers, and the status. We never see or store your card number, UPI PIN or bank credentials.
• Messages: whatever you write in the chat or a support ticket, and our replies.
• Operational records: a log of emails we sent you, and the standard server logs kept by our hosting provider.

3. People who never signed up

A requirement carries the name and mobile number of whoever is at the pickup and the delivery point. Those people have no account with us and did not hand us their details — the customer did.

We use them for one thing: letting a driver reach the right person at the gate. They are not marketed to, not profiled, and not passed beyond the transport partner carrying that shipment. If you are one of those contacts and would rather we did not hold your number, write to the grievance officer below and we will remove it from any shipment not already in transit.

If you are the customer entering somebody else's details, you are confirming you have their permission to share them with us for this purpose.

4. What we rely on to process it

Most processing here rests on consent, given when you create an account. Consent is not bundled: you can use the marketplace without agreeing to marketing, because we do not send any.

Some processing does not depend on consent and continues regardless of it — chiefly keeping invoices, payment records and tax records for as long as Indian law requires.

5. Who else sees it

ColdRun does not sell personal data and does not share it for anyone else's advertising. It reaches four kinds of recipient and no others.

• The transport partner carrying your shipment — and only after you accept their quote. Before that they see the cities, the load, the temperature and the date, never your address or phone number.
• The providers who run parts of the platform: Clerk (sign-in), Razorpay (payments), Brevo (email), Cloudflare R2 (uploaded documents and photographs), Neon (database) and Vercel (hosting). Each processes data on our instructions to deliver the service, and some store it outside India.
• Our accountant, and our legal advisers where a dispute requires it.
• A public authority, where we are legally obliged to produce it.

6. How long we keep it

Personal data is erased once the purpose it was collected for is finished, unless a law requires us to keep it longer.

• Account details: while your account is open, and one year after you close it, so a dispute raised late can still be answered.
• Shipment records, including pickup and delivery contacts: three years from delivery.
• Invoices, payment records and anything bearing on tax: eight years, as required of GST records in India. These survive account closure.
• Partner compliance documents — PAN, GST certificate, cancelled cheque: while the partner is active, and one year after. Documents belonging to a rejected application are deleted within ninety days of the decision.
• Chat and support messages: three years from the last message in the conversation.
• Proof-of-delivery photographs: three years from delivery.
• Email delivery logs: one year.

7. Your rights

Under the DPDP Act you may ask us to do any of the following, and we will answer within thirty days.

• Tell you what personal data of yours we hold, and who we have shared it with.
• Correct anything inaccurate, complete anything incomplete, update anything stale.
• Erase what we hold, where no law obliges us to keep it. Where something must be kept — a tax record, most often — we will say so, and say why.
• Withdraw your consent. Withdrawing it is as easy as giving it and stops the processing that depended on it, though it does not undo what was lawfully done beforehand.
• Nominate somebody to exercise these rights for you if you die or become unable to do so yourself.
• Complain to the Data Protection Board of India if our answer does not satisfy you. We would rather you came to us first.

8. How it is protected

Access is limited to what an account is entitled to: a customer sees only their own shipments, a partner only trips they were offered or won, and administrative screens require an administrator account. Everything travels over HTTPS. Passwords are held by our sign-in provider and never by us.

No system is beyond compromise. If a breach occurs that affects your data we will report it to the Data Protection Board of India and tell you directly what happened, what was exposed, and what to do about it.

9. Children

ColdRun is a business-to-business service and is not intended for anybody under eighteen. We do not knowingly hold a child's personal data, and do not profile or advertise to children. If you believe a child's data has reached us, tell the grievance officer and we will erase it.

10. Cookies and tracking

We set the cookies our sign-in provider needs to keep you signed in, and nothing else. There is no advertising network on this site, no third-party analytics, and no cross-site tracking.

11. Changes to this notice

We will change this notice when what we do changes, and the date at the top will change with it. Where a change materially affects your rights we will tell you by email rather than rely on you to re-read the page. This version is dated 30 August 2026.